Exploitation Research Plan: CVE-2025-13842 (Breadcrumb NavXT)

1. Vulnerability Summary

The Breadcrumb NavXT plugin (versions <= 7.5.0) contains an authorization bypass vulnerability in its Gutenberg block rendering logic. The file includes/blocks/build/breadcrumb-trail/render.php processes the rendering of the "Breadcrumb Trail" block. This file checks for a post_id within the $_REQUEST superglobal and uses it to generate the breadcrumb trail without verifying if the current user has permission to view the post associated with that ID.

This allows unauthenticated attackers to view the breadcrumb hierarchy and titles of Draft, Private, or Password Protected posts by providing their IDs, leading to sensitive information exposure.

2. Attack Vector Analysis

• Endpoint: Any public-facing WordPress page or post that contains the Breadcrumb NavXT "Breadcrumb Trail" block.
• Vulnerable Parameter: post_id (via $_GET, $_POST, or $_REQUEST).
• Authentication: None (Unauthenticated).
• Preconditions:
  1. The plugin Breadcrumb NavXT (<= 7.5.0) must be active.
  2. At least one public page must contain the breadcrumb-navxt/breadcrumb-trail Gutenberg block.
  3. The attacker needs to guess or enumerate Post IDs (standard WordPress integer increments).

3. Code Flow

1. Entry Point: A visitor requests a page that includes the Breadcrumb NavXT block.
2. Hook Registration: The block is registered via register_block_type (likely in breadcrumb-navxt.php or a block initialization file), pointing to includes/blocks/build/breadcrumb-trail/render.php as the render_callback.
3. Vulnerable Logic (in render.php):
   • The code retrieves the ID for which to generate breadcrumbs.
   • It prioritizes $_REQUEST['post_id'] (or a similar key) if present.
   • Example (Inferred):

     $p_id = isset($_REQUEST['post_id']) ? intval($_REQUEST['post_id']) : get_the_ID();
     // The plugin then initializes the breadcrumb trail for $p_id
     $breadcrumb_trail = new bcn_breadcrumb_trail();
     $breadcrumb_trail->fill($p_id); 
     echo $breadcrumb_trail->display();
     

4. Sink: The fill() and display() methods of the bcn_breadcrumb_trail class generate HTML containing the post title and its parent hierarchy. Since no current_user_can('read_post', $p_id) check is performed in render.php, the data is rendered and returned to the unauthenticated user.

4. Nonce Acquisition Strategy

According to the vulnerability description, this is an Authorization Bypass through User-Controlled Key during a block render.

• Requirement: This specific vulnerability usually does not require a nonce because it exploits the standard rendering of a block on a public page. Block renderers (render.php) are executed by WordPress core when the content is parsed for display.
• Verification: If the exploit fails, I will check if the plugin localizes any variables for the block.
  • Potential variable names: bcn_block_options or similar.
  • However, for an unauthenticated information exposure via query parameters, a nonce is highly unlikely.

5. Exploitation Strategy

Step-by-Step Plan:

1. Locate Target ID: Enumerate or use a known ID of a private/draft post.
2. Identify Target Page: Locate a public page containing the [breadcrumb-trail] block or the equivalent Gutenberg block.
3. Send Exploit Request: Perform a GET request to the public page, appending the post_id of the private post.
4. Extract Data: Parse the HTML response to find the breadcrumb trail and extract the title of the private post.

Specific HTTP Request:

GET /?p=[PUBLIC_PAGE_ID]&post_id=[PRIVATE_POST_ID] HTTP/1.1
Host: localhost:8080
User-Agent: Mozilla/5.0

6. Test Data Setup

1. Create Private Post:
   • wp post create --post_type=post --post_title="SECRET_INTERNAL_PROJECT" --post_status=private --post_content="Confidential info"
   • Record the ID (e.g., 123).
2. Create Public Page with Block:
   • wp post create --post_type=page --post_title="Public Breadcrumb Page" --post_status=publish --post_content='<!-- wp:breadcrumb-navxt/breadcrumb-trail /-->'
   • Record the ID (e.g., 456).
3. Configure Plugin: Ensure Breadcrumb NavXT is activated.
   • wp plugin activate breadcrumb-navxt

7. Expected Results

• Unauthenticated Success: The HTTP response for the public page (?p=456&post_id=123) will contain the string "SECRET_INTERNAL_PROJECT" within the breadcrumb HTML structure (typically inside <span> or <li> tags generated by the plugin).
• Normal Behavior (Expected for Patched): The breadcrumb trail should either ignore the post_id parameter or perform a capability check, showing breadcrumbs for page 456 only.

8. Verification Steps

1. Check Response Body:
   • Look for the title of the private post created in Step 6.
2. Verify via WP-CLI:
   • Confirm the post with that title is indeed private:
     wp post get [PRIVATE_ID] --field=post_status
3. Confirm Privacy:
   • Verify that a direct request to /?p=[PRIVATE_ID] returns a 404 or a login redirect, proving the post is not normally accessible.

9. Alternative Approaches

• Enumeration Script: If the post ID is unknown, a simple loop from 1 to 100 on the post_id parameter can be used to discover hidden content.
• REST API Check: Check if the Gutenberg block render_callback can be reached via the REST API autosave or render-block endpoints, which sometimes expose similar flaws:
  GET /wp-json/wp/v2/block-renderer/breadcrumb-navxt/breadcrumb-trail?context=edit&post_id=[PRIVATE_ID]
  (Note: This usually requires 'edit' permissions, whereas the render.php flaw is reported as unauthenticated).
• POST Request: Try sending post_id in a POST body to the same URL if GET is filtered.